CVE-2024-48232: mipjz · Server-Side Request Forgery (SSRF)
Affects mipjzSource CVE Database V5
Not known to be exploited · CVSS 4.9 Medium.
Data as of 26 Oct 2026, 09:15 UTC
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 42% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 25 Oct 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
GitHubsansanyun/mipjzpkg:github/sansanyun/mipjzOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
To mitigate CVE-2024-48232, organizations should implement strict input validation and sanitization for the postAddress parameter to ensure only authorized and safe URLs or IP addresses are accepted. Employ allowlisting to restrict curl_exec calls to known, trusted endpoints. Limit the use of curl_exec or similar functions to contexts where input is fully controlled or sanitized. Apply the principle of least privilege by restricting access to the vulnerable API endpoint to only necessary high-privilege users and monitor usage for suspicious activity. Network segmentation and firewall rules can help prevent SSRF from reaching internal resources. Regularly audit and monitor logs for unusual outbound requests originating from the server. Finally, keep the mipjz software updated and subscribe to vendor advisories for timely patch deployment.
Description
An issue was found in mipjz 5.0.5. In the mipPost method of \app\setting\controller\ApiAdminTool.php, the value of the postAddress parameter is not processed and is directly passed into curl_exec execution and output, resulting in a Server-side request forgery (SSRF) vulnerability that can read server files.